Two teenagers who became Britain’s biggest cyber hackers are facing jail for a £29 million attack on the London transport network after being caught out by a takeaway order.
Thalha Jubair and Owen Flowers took down Transport for London (TfL) in a four-day cyber attack that threatened to cause £56 billion of ‘catastrophic damage’.
Jubair even spoke of ‘nuking’ access to the system, but TfL managed to ‘pull the plug’ on the network to stop the duo.
Now it can be revealed how the pair became Britain’s worst hackers, ransoming companies around the world for tens of millions of pounds, continuing to wreak havoc even behind bars.
The prolific pair were members of the notorious Scattered Spider network, which has been tied to attacks on Jaguar Land Rover costing an estimated £1.9 billion, a £300 million hack of M&S, and attacks on Harrods and the Co-op causing losses of £206 million.
Even as Flowers, 18, was behind bars, he used a smuggled phone to try to hack into the Crown Prosecution Service, the Ministry of Justice, various Government domains and even the prison he was being held in.
Meanwhile, Jubair, now 20, is estimated to have handled £200 million in cryptocurrency from ransoming businesses since he became a hacker at the age of 13, US prosecutors believe.
Ultimately it was the spending of that cash that was to prove his undoing after Jubair splashed out, not on fast cars or jewellery, but on food takeaways.
He bought gift vouchers for a food delivery service using a cryptocurrency wallet containing £27 million he and his fellow hackers had allegedly taken in ransom payments from major US companies.
The mistake led the FBI right to his door by tracing the takeaways, discovering that one of the most dangerous cyber hackers in Britain was a 17-year-old autistic loner living with his parents in a high-rise block next to a Met Police call handling centre in Tower Hamlets, East London.
Yesterday, Jubair’s lawyer Paul Keleher, KC, told Woolwich Crown Court that his client was a ‘modern-day Oliver Twist’, groomed by criminals to hack companies from the age of 13.
In a cautionary tale of an ‘online upbringing’, Jubair was given a smartphone at the age of four, and he got his first laptop at six from his father, who was a care worker, and from his mother, who worked with children who have special needs.
By the age of nine, Jubair was writing computer programmes. At 13, he had graduated to hacking after being recruited on gaming platforms such as Roblox. By 15, he had managed to infiltrate the City of London Police systems.
Mr Keleher said his client later graduated to becoming the ‘Artful Dodger’, recruiting other young hackers and teaching them tricks.
He revelled in his growing reputation online after being ridiculed and isolated at school.
His bedroom in a 22-storey tower block became the unlikely headquarters of a millionaire cyber criminal while Jubair was still at school.
He started off with SIM-swapping – when an individual’s mobile phone number is redirected to a hacker, allowing authentication codes to be sent straight to criminals.
In 2021, Jubair amassed 700 victims using this technique in an attack on BT/EE.
By the age of 15, he was part of a teenage hacking group described by prosecutors as ‘online bandits’, claiming tech giants such as Microsoft, Nvidia, Samsung, T-Mobile and Uber among their victims, stealing data and source code, including the unreleased Grand Theft Auto 6 from Rockstar.
Despite being under police investigation, Jubair was more nervous about his parents finding out, according to messages sent to other hackers.
But in the event, he was arrested in his school uniform. In 2023, he was convicted of 22 offences including blackmail, fraud and stalking, receiving an 18-month youth rehabilitation order.
But Jubair continued to target major corporations. US prosecutors have linked him and his associates to at least $115 million (£86 million) in ransom payments, including from a major hack of Las Vegas casinos.
Court documents allege that Jubair even hacked the US federal court system by contacting the help desk, impersonating a judge to ask for a password reset, then gaining entry to the judge’s email account.
In September 2024, Jubair vowed to ‘f*** the railways’ and ‘nuk[e] access’ after compromising the account of a single employee to hack into Transport for London’s systems.
Although buses and tubes were kept running, the breach disrupted TfL services for months, affected the personal data of millions of people and left all 28,000 TfL employees needing to reset their passwords in person.
The booking system for the Dial-a-Ride buses used by those with disabilities was shut down, and data on live Tube times for apps such as TfL Go and Citymapper was taken offline.
Jubair and Flowers hunted celebrity TfL users, but the duo were unable to get into credit card details.
When police pounced just hours later, they caught Flowers in the act of hacking two US healthcare companies from his bedroom in Walsall, West Midlands, where he lived with his grandmother.
Even in a prison cell, he continued to profit from his crimes, receiving £450,000 in Bitcoin, which he intended to ‘wash’ for clean cryptocurrency to pay drug debts from smoking cannabis behind bars.
Flowers boasted to other hackers that he would be out of prison soon: ‘Bro, I’ll get 2 ish years for TfL. Would have done a year by trial. Go home straight away. Right now it’s a section 3za [offence] which is 14 years max [in] prison, but cuz I was youth I won’t get as long as.’
He added: ‘Bro, I’ve been studying law on the side since I got arrested. Studying the judges I might get.’
Perhaps as the pair are sentenced at Woolwich Crown Court, they may discover the judge is less understanding.
As Mr Justice Turner stated: ‘There’s no Fagin in this case, it’s a Fagin-less crime.’
Perhaps they could get them to work with cyber security to instruct them on what to do to prevent this.
Just think, if they used their intelligence legally, they could run our treasury department, and we’d be sorted.
Parents don’t seem to have a clue what their kids are doing, but provide the money and equipment to let them do it.
I’ve got to confess, it’s kind of impressive. A Bedroom cyber‑brats blitz TfL for £29 million — then blow their masterplan with a takeaway blunder worthy of a sitcom.
The thing that truly bothers me is that our government believe it’s completely safe to put all of our money and sensitive and confidential data into computerised and cloud databases.
One of them will probably pass the bar and go on to become a top judge, just as a sideline so he can fight his own case. Another ‘catch me if you can’ chap.
They’re clearly excessively intelligent. Pity they didn’t use their genius to do something else that wasn’t criminal.
Being that intelligent means they must have been extremely bored at school – idle hands… devil’s work!
One day we will wake up to find no money in our Bank Accounts, not stolen, just wiped. With no history, except our printed bank statements; well, for those who still get them, most don’t.
Technology will be the destruction of civilisation.
Highly intelligent people seldom fit in with the rest of society. Some are groomed, some do it for the pleasure of it, and instead of leaving them by the wayside, their minds need to be challenged.
Indeed, they have committed a crime, and that needs to be penalised in some way. I’m not sure jail time is the way to go, but they should never be allowed any electronic devices again, and they should be tagged continuously.
Hey! Some people might not agree with me. I can please people some of the time; I can’t please them all the time.
THE MONTHLY MOSQUITO 